About smithy001

smithy001 · ‎11-23-2023

Thanks for that information

smithy001 · ‎11-15-2023

Thanks for that, as I stated rf/sf is 1 per site so total of 2 searchable copies due to costs. I want to know the best way to spread the buckets of an index over as many indexers as possible to get the best bandwidth out of the I/O sub-system. Cheers

smithy001 · ‎11-15-2023

So rather than have 2 volumes just have 1 and use tiered storage so that you only need to monitor the usage at the storage system. Make capacity planning much easier and hardware tiering is far more efficient/performant as accessed data will be elevated to a higher performance tier.

smithy001 · ‎11-10-2023

Thanks for the reply...I understand the use of 2 separate volumes. I was asking if anyone could see a situation where the cold [spindle] volume could become full whilst the hot/warm[ssd] still had capacity if both were sized the same... 6 months on SSD 6 months on spindle...

smithy001 · ‎11-10-2023

the actual config has not been decided yet. I'm trying to find the best one to spread the buckets across the indexers.

smithy001 · ‎11-09-2023

if we configure a fast volume for hot/warm and slower spindles for cold and set maxVolumeDataSizeMB to enforce sizes. can you see any situation where cold would file but hot/warm would still have space?

smithy001 · ‎11-09-2023

I have a client creating a new system that will have 2 sites with rf/sf per site being 1 and the total rf/sf being 2. Each site will have 3+ indexers. My question is how this effects bucket distribution over the indexers if you leave maxbucket as the default of 3 and is there any performance implications They're going rf/sf as 1 due to disk costs. Thanks in advance

smithy001 · ‎01-17-2023

I've got the same issue...tried everything I know on the unix front...did you ever find a solution for this as it's a bit of a show stopper as I want to install keepalived on universal for simple HA solution Cheers

smithy001 · ‎02-17-2022

Had the same issue. Cleared /tmp down and worked fine... Can only assume splunk GUI loads to /tmp

smithy001 · ‎11-27-2019

v 7.3.1 to 8.0.0 [patched locally with datetime.xml fix] 4 node SH cluster with 6 node [2 sites] index cluster The readiness app seems to stop @ the culprit app and not scan any further!!!! We removed the *NIX app and the Tenable[Nessus] one and all it all started fine and dandy under version 8.

smithy001 · ‎07-04-2018

We had the same problem because the app was renamed from splunk_app_jenkins to SA-Jenkins on the Search Heads to align with our in house naming convention renamed back to splunk_app_jenkins restarted the search heads and all worked fine.... ,

Posts	11
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎07-04-2018

Online Status	Offline
Date Last Visited	‎11-23-2023 08:31 AM

buckets - hot/warm and cold on 2 separate volumes

rf/sf set to 1 for 2 site system.

Re: rf/sf set to 1 for 2 site system.

Re: rf/sf set to 1 for 2 site system.

Re: buckets - hot/warm and cold on 2 separate volu...

Re: buckets - hot/warm and cold on 2 separate volu...

Re: rf/sf set to 1 for 2 site system.

buckets - hot/warm and cold on 2 separate volumes

rf/sf set to 1 for 2 site system.

Re: How to add packages to Splunk Docker Container

Re: Upgrade Failing with OSError type 28

Re: Splunk 8.0 upgrade has no web server running

Re: Jenkins Plugin fails to install